US20170006121A1

US20170006121A1 - Identification of collaborating and gathering entities

Info

Publication number: US20170006121A1
Application number: US14/788,185
Authority: US
Inventors: Kirk J. Krauss
Original assignee: International Business Machines Corp
Current assignee: International Business Machines Corp
Priority date: 2015-06-30
Filing date: 2015-06-30
Publication date: 2017-01-05
Also published as: US10122805B2

Abstract

Provided are techniques for identification of collaborating entities. It is determined whether a first entity is associated with a second entity on at least a certain number of occasions over a certain first time interval. In response to a positive determination, a first instance of affinity is found between the first entity and the second entity. A collaboration is identified based on the first instance of affinity and one or more second instances of affinity found within one or more certain portions of a second time interval. The collaboration of the first entity and the second entity is reported.

Description

BACKGROUND

Embodiments of the invention relate to determining relationships among entities. For example, embodiments of the invention relate to privacy enhanced identification of mutually friendly entities (e.g., friends). Embodiments also relate to privacy enhanced identification of collaborating and gathering entities. Embodiments relate to software-implemented behavioral analytics and involve event-driven observation and tracking of physical entities in order to flag occurrences of certain repeating entity behavior.
An entity may be any object, such as a person, place, thing, or event. Entity analytics systems attempt to identify two or more entities as related based on some features that the entities share. For example, two entities with the same address may be treated as related.

SUMMARY

Provided is a method for privacy enhanced identification of collaborating entities. The method comprises determining whether a first entity is associated with a second entity on at least a certain number of occasions over a certain first time interval; in response to a positive determination, finding a first instance of affinity between the first entity and the second entity; identifying a collaboration based on the first instance of affinity and one or more second instances of affinity found within one or more certain portions of a second time interval; and reporting the collaboration of the first entity and the second entity.
Provided is a computer program product for privacy enhanced identification of collaborating entities. The computer program product comprises a computer readable storage medium having program code embodied therewith, the program code executable by at least one processor to perform: determining whether a first entity is associated with a second entity on at least a certain number of occasions over a certain first time interval; in response to a positive determination, finding a first instance of affinity between the first entity and the second entity; identifying a collaboration based on the first instance of affinity and one or more second instances of affinity found within one or more certain portions of a second time interval; and reporting the collaboration of the first entity and the second entity.
Provided is a computer system for privacy enhanced identification of collaborating entities. The computer system comprises: one or more processors, one or more computer-readable memories and one or more computer-readable, tangible storage devices; and program instructions, stored on at least one of the one or more computer-readable, tangible storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to perform: determining whether a first entity is associated with a second entity on at least a certain number of occasions over a certain first time interval; in response to a positive determination, finding a first instance of affinity between the first entity and the second entity; identifying a collaboration based on the first instance of affinity and one or more second instances of affinity found within one or more certain portions of a second time interval; and reporting the collaboration of the first entity and the second entity.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

Referring now to the drawings in which like reference numbers represent corresponding parts throughout:

FIG. 1 illustrates, in a block diagram, a computing environment in accordance with certain embodiments.

FIG. 2 illustrates an example configuration file in accordance with certain embodiments.

FIG. 3 illustrates an example extended configuration file in accordance with certain embodiments.

FIGS. 4A, 4B, 4C, and 4D illustrate, in a flowchart, operations for identifying collaborating entities and gatherings in accordance with certain embodiments.

FIG. 5 illustrates a cloud computing node in accordance with certain embodiments.

FIG. 6 illustrates a cloud computing environment in accordance with certain embodiments.

FIG. 7 illustrates abstraction model layers in accordance with certain embodiments.

DETAILED DESCRIPTION

The descriptions of the various embodiments of the present invention have been presented for purposes of illustration but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.
Entity analytics products may find observed physical entities to be related by features they have in common, such as their proximity in space and time. However, some entity interactions become of interest when they are observed to repeat a certain number of times. Two entities that happen to pass by each other occasionally, or even to be located in the same vicinity as one another for some time, may have no significant relationship. On the other hand, entities that meet in various locations over and over, spanning a timeframe too long for those meetings to be written off as chance encounters, are likely to have a reason for those meetings. Meetings of entities, either physically or virtually via a communication medium, may indicate a kind of entity relationship worthwhile to identify. Meetings that repeat, and/or meetings that involve a significant number of entities, also may be worthwhile to distinguish from smaller or non-repeating entity interactions.
Entities that have a physical affinity with each other may be identified when a first entity is observed within a certain spatial proximity of a second entity, on at least a certain number of occasions (e.g., at least a certain number of times), over a certain time interval. Entities that have a virtual affinity with each other may be identified when a first entity is observed to communicate (e.g., electronically by electronic mail (e-mail), a chat session, a telephone conversation or teleconference, radio communication, etc.) or otherwise interact with a second entity, on at least a certain number of occasions, over a certain time interval. With embodiments, the entities may meet at different locations, over time, and yet qualify as having an affinity. In certain embodiments, a minimum number of entities, or a minimum number of affinity occurrences, may be set to qualify for reporting as “a gathering” or as “collaborators”, respectively.
Affinities may qualify for reporting as-is, or based on a required number of involved entities (e.g., identifying “a gathering”), or based on repeating occurrences of affinity (e.g., identifying “collaborators”). A gathering may be reported when a certain number of entities is observed to accumulate within a certain physical distance of each other or when a certain number of entities virtually interact with each other, per the aforementioned criteria that define what “affinity with each other” means. A situation in which entities behave as collaborators may be reported when the entities meet or interact on an ongoing basis.
In particular, in certain embodiments, affinities by themselves may not be interesting. In some situations, affinities may be identified as the result of chance encounters, misdirection or confusion, or loose associations, etc., rather than as the result of a deeper relationship. For example, a software component that is used in conjunction with, or made part of, an entity analytics product in accordance with certain embodiments, may be configured in a privacy-enhanced manner to identify affinities among persons by receiving inbound observations of interactions between those persons. Such a software component may identify an affinity by counting each encounter, among the inbound observations, between a shopper at checkout and a store clerk. Based on the software component's configuration settings, it may identify these affinities simply because the store clerk is present while item after item gets scanned through, rung up, and bagged. However, this type of affinity may not be of interest.
A collaboration (or “collaborating entities”) and a gathering are each defined in terms of affinities. In certain embodiments, a collaboration may involve as few as two entities. In certain embodiments, a gathering may involve more than two entities.
A collaboration may be identified when embodiments keep finding affinities among any two entities—that is, some number of affinities over some time interval that is a longer interval than is used to detect the underlying affinities themselves. This means that these identical entities show a consistent behavior of getting together, and for more than one observation at a time, not only over and over, but often enough so that embodiments determine that they collaborate. For example, say the store clerk of the previous example keeps leaving work together with another person. Based on observations of this repeating behavior among the inbound data, the software component of the previous example may identify a collaboration between the store clerk and the other person. The collaboration may be worth reporting. This reporting may be especially useful if there are other factors that are of interest to the software component's users for the time interval (e.g., if a suspected crime were to occur during that time interval).
A gathering may be identified when embodiments detect affinities among large numbers of entities. Unlike with collaboration findings, the entities need not get together repeatedly for the time that it takes to find an affinity over and over. They instead can get together in sufficiently large numbers at once, for long enough to find the affinities among them all, to qualify as a gathering. Because a gathering is identified based on affinities, the gathering can indicate something more than just a bunch of people visiting the park and happening to pass by each other around, say, a fountain, on the way through. The entire set of those particular entities must remain together for a configurable time span that qualifies for an affinity finding, before embodiments generate a configurable number of affinity findings on which a gathering report may be based.
FIG. 1 illustrates, in a block diagram, a computing environment in accordance with certain embodiments. Computing nodes 100 a . . . 100 n are coupled to each other and to a data store 150. The ellipses indicate that there may be any number of computing nodes in various embodiments. Each of the computing nodes 100 a . . . 100 n includes, respectively, a detector 110 a . . . 110 n and a configuration file 120 a . . . 120 n. The detector 110 a . . . 110 n may detect affinities, collaborators (or “collaborations”), and gatherings. The use of a file for configuration purposes is illustrative, and other configuration means may apply for some embodiments. In various embodiments the detector 110 a . . . 110 n may be, as in the previous example, a software component that is used in conjunction with, or made part of, an entity analytics product. In some embodiments, the detector 110 a . . . 110 n may run as an operator for a stream computing system that performs analytics on real-time data. In some embodiments, the detector 110 a . . . 110 n may assume other forms.
The data store 150 includes inbound observations 160, results 170 (e.g., that identify collaborators and gatherings), and reports 180 (e.g., that provide information about the collaborators and the gatherings). The inbound observations 160 are from one or more data sources 190 a . . . 190 n and may include data received with respect to the locations of different entities (e.g., from satellite or ground-based navigational systems, from the Automatic Identification System (AIS) tracking system for oceangoing vessels, from devices such as smart phones or radio-frequency identification (RFID) tags carried by the entities, or from software that can determine the motion of entities depicted in a series of images, to name a few examples). Although one data store is illustrated, the computing nodes 100 a . . . 100 n may be coupled to and may communicate with any number of data stores.
The computing nodes 100 a . . . 100 n may be parallel processing nodes. The data store 150 may store big data (i.e., a large amount of structured, semi-structured, or unstructured data accessed and stored via an Apache™ Hadoop® software framework, a Hadoop Distributed File System (HDFS™) software framework, a stream computing platform, or other means of accessing and storing such data). Apache, Hadoop, and Hadoop Distributed File System (HDFS) are trademarks or registered trademarks of the Apache Software Foundation in the United States and/or other countries. Thus, certain embodiments provide a big data, parallel-processing-ready technique for identifying collaborating entities. For scalability of certain embodiments, any event accumulation beyond the time interval is thrown away and event accumulation begins anew. The time and proximity horizons are configurable according to the entity type (e.g. oceangoing vessels may need larger horizons, for both space and time, than cultured bacteria) and may be concurrently applied at different granularities to entities in the same dataset. Therefore, embodiments provide high-performance, highly scalable determination of mutually collaborating entities or gatherings of entities over very large datasets.
The detector 110 a . . . 110 n monitors the movement and/or communication and interaction behavior of entities, flagging conditions where an entity is observed meeting or interacting with another entity. Multiple entities may be flagged to meet or interact together. The data sources, entity types, geographic areas, and communication/interaction techniques covered by affinity detection may be user-configurable. The detector 110 a . . . 110 n may use in-memory event tracking to detect affinities with optimum efficiency.
In certain embodiments, because the detector 110 a . . . 110 n in-memory event data is not shared across processes, incoming behavioral data for a particular entity may be consistently passed to a particular detector node tracking that entity. Embodiments may implement the association between entity identifiers and computing nodes via a simple modulo function.
The detector 110 a . . . 110 n in-memory event data may be volatile. Whenever the detector 110 a . . . 110 n is exited and restarted, any work-in-progress affinities may be lost. This means stopping and re-starting the detector 110 a . . . 110 n may affect which affinities are detected. In certain embodiments, when the detector 110 a . . . 110 n is restarted, applicable behavioral records from behavioral data history (e.g., going back 48 hours) may be processed by the detector 110 a . . . 110 n.
In certain embodiments, affinities may be detected based on configurable time windows or time horizons whose durations have practical limits based on the number of entities and events that are tracked. Events expire as time moves on past those time horizons, and the memory used for tracking expired events is reclaimed. A user who needs to set up horizons of very wide-ranging durations (as with detection of varying types of entities that are collaborators) may assign tasks to multiple detector processes for scalability.
FIG. 2 illustrates an example configuration file 200 in accordance with certain embodiments. The configuration file (or an affinity configuration record or equivalent data) is used to configure “what is defined as affinity” and “what is defined as a collaboration”. The configurable parameters for “what is defined as affinity” may include a qualifying time interval and a minimum number of events for any given data source, entity type, geographic area, and/or communication/interaction type. The configurable parameters for “what is defined as collaborators” may include a qualifying number of affinity findings, involving any given pair of entities, that fit criteria for reporting the entities as collaborators. A parameter that may further define collaborators is an additional qualifying time interval within which the affinities must accumulate to qualify a collaboration finding. A parameter that may yet further define collaborators is a time slice duration, within the additional qualifying time interval, within which repeating affinity findings do not count toward the affinity accumulation that qualifies as collaboration finding. When the qualifying conditions for an affinity finding are met, the detector 110 a . . . 110 n may produce an affinity record (e.g. an Extensible Markup Language (XML) structure) for the identified entities, or it may simply track the affinity finding in memory without producing any further record besides the memory content itself. When the qualifying conditions for a collaboration finding are met, the detector 110 a . . . 110 n produces a collaboration record (e.g. an Extensible Markup Language (XML) structure) for the entity.
The configuration file may associate data sources, entity types, and identifiers for zones of spatial eligibility or interaction eligibility with time and event thresholds. For the configuration file 200, the configurable parameters for basic collaborator reporting may include the following:
DSRC_CODE—Data source code
An identifier designating the data source, e.g., “AIS” (which indicates the Automatic Identification System used on ships and by vessel traffic services (VTS)).
ETYPE_CODE—Entity type code
An identifier designating the entity type, e.g., “VESSEL”.
PROXIMITY—Spatial zone of eligibility
An identifier for a distance within which two entities may be considered to physically meet. If the value in this field is zero, then distance is unlimited (i.e. not an eligibility factor). In certain embodiments, the proximity is determined in meters. In other embodiments, the proximity is specified with other units or systems of measure, such as seconds of arc for certain geospatial navigation systems, or proximity to an RFID transponder for RFID-based systems.
PROXIMITY_UNITS—Spatial zone of eligibility units of measure
An identifier for the units of measure applicable to the PROXIMITY value. For example, acceptable identifiers may include kilometers, meters, or millimeters.
INTERACTION_MODE—Mode of communication (e.g., electronic mail (e-mail), on-line chat, telephone conversation or teleconference, wireless radio communication, wireline communication, etc.) or interaction between entities (e.g. conversational, event-driven, etc.).
An identifier for a mode of communication or interaction via which entities may be considered to virtually meet. If the value in this field is zero, then interaction modes are unlimited (i.e., not an eligibility factor).
AFFINITY_QUAL_TIME_INTERVAL—Affinity qualifying time interval
A numeric value representing a time horizon, which is a maximum qualifying time interval in which a meeting or interaction becomes time-qualified for an affinity finding. A meeting or interaction may also need to qualify based on the number of events specified in the AFFINITY_MIN_EVENTS field described below.
AFFINITY_QUAL_TIME_UNITS—Affinity qualifying time units of measure
An identifier for the units of measure applicable to the AFFINITY_QUAL_TIME_INTERVAL value. For example, acceptable identifiers may include year, month, day, hour, minutes, seconds, and milliseconds.
AFFINITY_MIN_EVENTS—Affinity minimum number of qualifying events
A numeric value representing the minimum qualifying number of events that are observed before the meeting or interaction becomes qualified for an affinity finding. A meeting or interaction may also need to qualify based on the time horizon specified in the AFFINITY_QUAL_TIME_INTERVAL and AFFINITY_QUAL_TIME_UNITS fields.
COLLABORATION_QUAL_TIME_INTERVAL—Collaboration qualifying time interval
A numeric value representing a time horizon, which is a qualifying time interval in which affinities become time-qualified for a collaboration finding. An affinity may also need to qualify based on the number of events specified in the COLLABORATION_MIN_EVENTS field described below.
COLLABORATION_TIME_SLICE—Collaboration time slice
A numeric value representing a time slice, or quantum of time within the interval set by the COLLABORATION_QUAL_TIME_INTERVAL value, during which no more than one affinity qualifies for a collaboration finding. In certain embodiments, when more than one affinity is found within this time interval, only one of them becomes time-qualified for a collaboration finding. If the value in this field is zero, then the minimum time between affinity findings is unlimited (i.e. not an eligibility factor).
COLLABORATION_QUAL_TIME_UNITS—Collaboration qualifying time interval and time slice units of measure
An identifier for the units of measure applicable to the COLLABORATION_QUAL_TIME_INTERVAL and COLLABORATION_TIME_SLICE values. For example, acceptable identifiers may include year, month, day, hour, minutes, seconds, and milliseconds.
COLLABORATION_MIN_EVENTS—Collaboration minimum number of qualifying events
A numeric value representing the minimum qualifying number of affinities that are observed in different collaboration time slices before the set of meetings or interactions represented by the affinities becomes qualified for a collaboration finding. An affinity also may need to qualify based on the time horizon specified in the COLLABORATION_QUAL_TIME_INTERVAL and COLLABORATION_QUAL_TIME_UNITS fields.
For example, configuration data for people interacting via email might define a five-day qualifying interval for affinity, and a three-occasion number of messages. This would indicate that an affinity finding may be generated for any two people who exchange email on three or more occasions within five days. The configuration data may further include a thirty-day collaboration qualifying interval over which collaborations may be detected, a ten-day collaboration time slice, and a minimum of two occasions on which an affinity must be found in different collaboration time slices, in order to qualify as a collaboration finding. If an embodiment thus configured observes an ongoing stream of email, then it could generate a collaboration report if on at least two occasions in separate ten-day timeframes, the two people exchange enough emails to qualify for affinity reporting.
As another example, configuration data for vessels might similarly define a five-day qualifying interval for affinity, and a three-occasion number of events on which the vessels are observed within a given spatial proximity of one another. This would indicate that an affinity report may be generated for any two vessels that meet on three or more occasions within five days. The configuration data may further include a sixty-day duration over which collaborations may be detected, a collaboration time slice of twenty days, and a minimum of three occasions on which affinity must be found at more than one collaboration time slice, in order to qualify a collaboration finding. If an embodiment thus configured observes an ongoing series of encounters within the designated proximity, even if those encounters are not all in a common vicinity or geospatial region, then it could generate a collaboration report if on at least three occasions in separate twenty-day timeframes, the two vessels are observed within the designated proximity of one another to an extent sufficient to qualify for affinity reporting.
In certain embodiments, for an XML message specifying an observation of an entity that has a latitude, longitude, and time associated with it, the detector 110 a . . . 110 n may consider any pair of entities observed sufficiently close to the same latitude and longitude, within the same generalized time interval, to qualify as an event for tracking purposes. A generalized time interval may be a time range determined by any technique that divides time into quanta of a configurable duration. The detector 110 a . . . 110 n may consider any pair of entities that correspond via a qualifying interaction mode within the same generalized time interval to similarly qualify as a tracked event. If sufficient tracked events accumulate within the qualifying duration and meet the eligibility requirements, then the detector 110 a . . . 110 n flags an affinity. In certain embodiments, the detector considers any event accumulation (not qualified as an affinity) that has exceeded the configured time horizon to be expired for purposes of basic affinity reporting. That is, the detector 110 a . . . 110 n generates no affinity report once the relevant events have expired. Rather, the detector 110 a . . . 110 n deallocates the memory for those accumulated events.
Based on an option designated EXPIRE_EVENTS_BY_TIME_INTERVAL (illustrated in FIG. 3 as Expire Events by Time Interval Selector), the detector 110 a . . . 110 n may alternatively track events associated with complete generalized time intervals. The detector 110 a . . . 110 n may then consider any event older than either the configured time horizon or the limit of the time interval to be expired. The detector 110 a . . . 110 n also may deallocate event records that have expired based on either the configured time horizon or the time interval, if the EXPIRE_EVENTS_BY_TIME_INTERVAL option is set.
For rapid entity and event lookup, the detector 110 a . . . 110 n may track entities in a binary search tree, in a skiplist sorted by numeric entity keys, or in any other data structure suited for rapid access to data elements in a large set. The event queues associated with each tracked entity may be First In First Out (FIFO) queues or lists. A queue cleanup thread may routinely inspect the tracked entities and corresponding tracked events, deallocating the tracking structures associated with any events older than the qualifying duration. The queue cleanup thread also can deallocate the tracking structures associated with any entities whose event queues have become entirely empty. Queue cleanup may be triggered on a periodic basis, or when memory or another resource falls below a threshold of availability, or when a Central Processing Unit (CPU) becomes idle.
When the detector 110 a . . . 110 n flags a detected basic affinity condition, the detector 110 a . . . 110 n may do so by passing data about the affinity to a user or to other software (e.g., an entity analytics engine) via data encoded, for example, as XML. The XML data may describe an observed feature of an entity as defined by the entity analytics engine (e.g., in the case of some entity analytics technology, with a feature type code of BEHAVIOR_KEY and a usage type code of AFFINITY; the XML data also may include a feature element whose code is EXPRESSION and whose value is a key corresponding to a spatial region in which the entities were most recently observed to have affinity). The following is an example of a prospective affinity record represented in XML:


<UMF_DOC>	Input document tag
<OBS>	Observation tag
<DSRC_CODE>AIS/DSRC_CODE>	Data describing a data source

and observation

<DSRC_ACTION>A</DSRC_ACTION>

<OBS_SRC_KEY>

477995071|2010-08-12 15:24:00</ OBS_SRC_KEY>

<SRC_CREATE_DATE>2010-08-12 15:24:00</SRC_CREATE_DATE >

<OBS_ENT>	Observed entity tag
<ETYPE_CODE>VESSEL</ETYPE_CODE>	Data describing an entity

<ENT_SRC_KEY>477995071|2010-08-12 15:24:00</ENT_SRC_KEY>

<ENT_SRC_DESC>477995071|2010-08-12 15:24:00</ENT_SRC_DESC>

<OBS_FEAT>

<FTYPE_CODE>MMSI_NUM</FTYPE_CODE>

Data describing a feature

<OBS_FELEM>

<FELEM_CODE>ID_NUM</FELEM_CODE>

<FELEM_VALUE>477995071</FELEM_VALUE>

</OBS_FELEM>

</OBS_FEAT>

<OBS_FEAT>

<FTYPE_CODE>BEHAVIOR_KEY</FTYPE_CODE>

Affinity feature data

<UTYPE_CODE>AFFINITY</UTYPE_CODE>

<USED_FROM_DT>

2010-08-12 14:24:00</ USED_FROM_DT>

<USED_THRU_DT>

2010-08-12 15:24:00</ USED_THRU_DT>

<OBS_FELEM>

<FELEM_CODE>EXPRESSION</FELEM_CODE>

Affinity feature

element data

<FELEM_VALUE>GR1_GH4_1HOUR|xn73|2010-08-12

14:24:00</FELEM_VALUE>

</OBS_FELEM>

</OBS_FEAT>

</OBS_ENT>

</OBS>

</UMF_DOC>

Examples of affinities that may be identified among entities include:

- Vessels that meet somewhere in the ocean, possibly at various locations over time.
- Cells of a certain type that proliferate in a patient's bloodstream.
- Persons who telephone one another regularly.
- Individual animals that mingle within a sizeable group and habitat.

The configuration file may be extended to configure “what is defined as a gathering”. These extended configurable parameters may include a qualifying number of entities that are in physical proximity, within the PROXIMITY criterion or that communicate or interact via the mode specified via the INTERACTION_MODE identifier. The extended configurable parameters also may include a setting that indicates whether affinity findings, on their own, shall be reported.
FIG. 3 illustrates an example extended configuration file 300 in accordance with certain embodiments. For the extended configuration file 300, the extended configurable parameters for reporting gatherings and collaborators may include the following:
MIN_GATHERING_SIZE—Minimum gathering size
An identifier for the number of entities that qualifies as a gathering. If this field is empty, no gatherings are reported.
REPORT_BASIC_AFFINITIES—Report Basic Affinities selector (storing Yes or No)
Enables basic affinity reporting or disables basic affinity reporting to better highlight gatherings and/or collaborators reporting.
In one embodiment, a gathering may be reported when MIN_GATHERING_SIZE entities are observed to have affinity within a spatial zone that is PROXIMITY units across. In an alternate embodiment, a gathering may be reported more loosely, i.e. for any set of entities where, for each entity, there can be found at least one other entity in the set that is observed within PROXIMITY units of that entity.
Certain embodiments determine that the first entity and the second entity are physically interacting when the first entity is within a certain spatial proximity of the second entity. Certain embodiments determine that the first entity and the second entity are virtually interacting when the first entity communicates electronically or via other signaling means with the second entity. Certain embodiments identify a mode with which the first entity communicates with the second entity. Certain embodiments identify more than two entities as interacting. With embodiments, the entities may include persons, animals, plants, buildings, cars, events and any other places, things, objects, etc. In certain embodiments, reporting of collaborators and/or gatherings may rely on evaluation of daily affinity records. These records may be treated as events. In one embodiment, the events are streamed to another process that determines collaborations and/or gatherings based on collections of affinity reports. Whether one or multiple processes are used, an example of this analysis may involve daily affinity reports treated as behavior to roll up to weekly or monthly collaborator and/or gathering reports.
Embodiments provide privacy enhanced identification of collaborating entities. For example, embodiments may generate an anonymous identifier for each entity. Then, when affinities, or gatherings, or collaborating entities are detected, the embodiments provide (e.g., in a report) the anonymous identifier for the collaborating entities, in lieu of any identifier that may be known outside the scope of the system embodying the invention. Thus, the entities are provided with privacy protection. In some embodiments, anonymized identifiers are the only entity identifiers available throughout the process of identifying affinities, gatherings, or collaborators. In some embodiments, these anonymized identifiers are provided in inbound records and can be returned in reports of affinities, gatherings, or collaborators reflecting the anonymized identifiers. In some embodiments, the reports generated contain no identifying information whatsoever and may simply indicate that an affinity, gathering, or collaboration is detected, along with the number of entities involved in the affinity, gathering, or collaboration.
FIGS. 4A, 4B, 4C, and 4D illustrate, in a flowchart, operations for identifying collaborating entities and gatherings in accordance with certain embodiments. Control begins at block 400 with the detector 110 a . . . 110 n receiving an inbound observation for an observed entity. In block 402, the detector 110 a . . . 100 n determines whether the observed entity is of a configured type. If so, processing continues to block 404, otherwise, processing loops back to block 400. In block 404, the detector 110 a . . . 100 n obtains an entity identifier, a spatial location, and a timestamp for the inbound observation.
In block 406, the detector 110 a . . . 100 n, for a next tracked entity (from a set of tracked entities for which tracking data is stored in data store 150) within a configured proximity and an affinity qualifying time interval relative to the observed entity, increments an interaction count for a pair of entities formed by the tracked entity and the observed entity. From block 406 (FIG. 4A), processing continues to block 410 (FIG. 4B).
In block 408, the detector 110 a . . . 100 n, for a next tracked entity (from a set of tracked entities) corresponding with the observed entity via a configured interaction mode since a start of a collaboration qualifying time interval, increments an interaction count for a pair of entities formed by the tracked entity and the observed entity. From block 408 (FIG. 4A), processing continues to block 410 (FIG. 4B).
Embodiments may implement a single loop that processes blocks 406 and 408 iteratively, and in some instances concurrently, with each other and/or with blocks 410 through 430, inclusive. In such embodiments, the interaction count of blocks 406 and 408 may be one and the same. In alternative embodiments, a first loop may process block 406 and blocks 410 through 430, inclusive, and a second loop may process block 408 and blocks 410 through 430, inclusive, in which case the interaction count may be reset between loops or may be defined as a separate value per loop. Some embodiments may implement either block 406 without implementing block 408 or may implement block 408 without implementing block 406.
In block 410, the detector 110 a . . . 100 n determines whether the interaction count is greater than an affinity minimum number of qualifying events. If so, processing continues to block 412, otherwise, processing continues to block 430 (FIG. 4C)
In block 412, the detector 110 a . . . 100 n records the pair of entities (formed by the tracked entity and the observed entity) as having an affinity and resets (e.g., clears) the interaction count. In block 414, the detector 110 a . . . 100 n determines whether a report basic affinities selector is set to indicate that the affinity is to be reported. If so, processing continues to block 416, otherwise, processing continues to block 418 (FIG. 4C). In block 416, the detector 110 a . . . 100 n reports the affinity.
In block 418, the detector 110 a . . . 100 n determines whether this pair of entities had prior affinities within a configured collaboration qualifying time interval. If so, processing continues to block 420, otherwise, processing continues to block 430. In block 420, the detector 110 a . . . 100 n determines whether any prior affinity of these entities is within a current collaboration time slice. If so, processing continues to block 422, otherwise, processing continues to block 430. In block 422, the detector 110 a . . . 100 n determines whether a collaboration minimum number of affinity events in other time slices have been found. If so, processing continues to block 424, otherwise, processing continues to block 430. In block 424, the detector 110 a . . . 100 n reports a collaboration. From block 424 (FIG. 4C), processing continues to block 426 (FIG. 4D).
In block 426, the detector 110 a . . . 100 n determines whether a minimum gathering size has been met. If so, processing continues to block 428, otherwise, processing continues to block 430 (FIG. 4C). In block 428, the detector 110 a . . . 100 n reports the gathering.
In block 430, the detector 110 a . . . 100 n determines whether there are more tracked entities to check (i.e. for further potential findings of affinities, collaborations, and/or gatherings among the tracked entities). If so, processing continues to blocks 406 (FIG. 4A) and 408 (FIG. 4A), otherwise, processing waits for another inbound observation.
In certain embodiments, the outcome of the processing of FIG. 4 as performed in accordance with a given set of qualifying conditions (as described with respect to FIG. 2 and FIG. 3) may be validated against a criterion. As previously disclosed herein, to qualify as collaborators, any two or more entities must have been qualified to generate affinity reports on at least the minimum number of occasions at intervals greater than or equal to the threshold time interval. Thus, if the number of reports is not in keeping with a criterion, the processing of FIG. 4 may be re-run given different qualifying conditions, either automatically (e.g. via machine learning or heuristic algorithms) or by referencing one or more different configuration files.

Cloud Embodiments

It is understood in advance that although this disclosure includes a detailed description on cloud computing, implementation of the teachings recited herein are not limited to a cloud computing environment. Rather, embodiments of the present invention are capable of being implemented in conjunction with any other type of computing environment now known or later developed.
Cloud computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g. networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with a provider of the service. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.
Characteristics are as follows:
On-demand self-service: a cloud consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with the service's provider.
Broad network access: capabilities are available over a network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).
Resource pooling: the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to demand. There is a sense of location independence in that the consumer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter).
Rapid elasticity: capabilities can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out and rapidly released to quickly scale in. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be purchased in any quantity at any time.
Measured service: cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported providing transparency for both the provider and consumer of the utilized service.
Service Models are as follows:
Software as a Service (SaaS): the capability provided to the consumer is to use the provider's applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.
Platform as a Service (PaaS): the capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations.
Infrastructure as a Service (IaaS): the capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed applications, and possibly limited control of select networking components (e.g., host firewalls).
Deployment Models are as follows:
Private cloud: the cloud infrastructure is operated solely for an organization. It may be managed by the organization or a third party and may exist on-premises or off-premises.
Community cloud: the cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be managed by the organizations or a third party and may exist on-premises or off-premises.
Public cloud: the cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.
Hybrid cloud: the cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load balancing between clouds).
A cloud computing environment is service oriented with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure comprising a network of interconnected nodes.
Referring now to FIG. 5, a schematic of an example of a cloud computing node is shown. Cloud computing node 510 is only one example of a suitable cloud computing node and is not intended to suggest any limitation as to the scope of use or functionality of embodiments of the invention described herein. Regardless, cloud computing node 510 is capable of being implemented and/or performing any of the functionality set forth hereinabove.
In cloud computing node 510 there is a computer system/server 512, which is operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well-known computing systems, environments, and/or configurations that may be suitable for use with computer system/server 512 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices, and the like.
Computer system/server 512 may be described in the general context of computer system executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, and so on that perform particular tasks or implement particular abstract data types. Computer system/server 512 may be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media including memory storage devices.
As shown in FIG. 5, computer system/server 512 in cloud computing node 510 is shown in the form of a general-purpose computing device. The components of computer system/server 512 may include, but are not limited to, one or more processors or processing units 516, a system memory 528, and a bus 518 that couples various system components including system memory 528 to processor 516.
Bus 518 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example, and not limitation, such architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnects (PCI) bus.
Computer system/server 512 typically includes a variety of computer system readable media. Such media may be any available media that is accessible by computer system/server 512, and it includes both volatile and non-volatile media, removable and non-removable media.
System memory 528 can include computer system readable media in the form of volatile memory, such as random access memory (RAM) 530 and/or cache memory 532. Computer system/server 512 may further include other removable/non-removable, volatile/non-volatile computer system storage media. By way of example only, storage system 534 can be provided for reading from and writing to a non-removable, non-volatile magnetic media (not shown and typically called a “hard drive”). Although not shown, a magnetic disk drive for reading from and writing to a removable, non-volatile magnetic disk (e.g., a “floppy disk”), a solid-state media device (e.g. a USB or SSD storage device or an SD card), and an optical disk drive for reading from or writing to a removable, non-volatile optical disk such as a CD-ROM, DVD-ROM, Blu-Ray, or other optical media can be provided. In such instances, each can be connected to bus 518 by one or more data media interfaces. As will be further depicted and described below, memory 528 may include at least one program product having a set (e.g., at least one) of program modules that are configured to carry out the functions of embodiments of the invention.
Program/utility 540, having a set (at least one) of program modules 542, may be stored in memory 528 by way of example, and not limitation, as well as an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data or some combination thereof, may include an implementation of a networking environment. Program modules 542 generally carry out the functions and/or methodologies of embodiments of the invention as described herein.
Computer system/server 512 may also communicate with one or more external devices 514 such as a keyboard, a pointing device, a display 524, etc.; one or more devices that enable a user to interact with computer system/server 512; and/or any devices (e.g., network card, modem, etc.) that enable computer system/server 512 to communicate with one or more other computing devices. Such communication can occur via Input/Output (I/O) interfaces 522. Still yet, computer system/server 512 can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and/or a public network (e.g., the Internet) via network adapter 520. As depicted, network adapter 520 communicates with the other components of computer system/server 512 via bus 518. It should be understood that although not shown, other hardware and/or software components could be used in conjunction with computer system/server 512. Examples, include, but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.
Referring now to FIG. 6, illustrative cloud computing environment 650 is depicted. As shown, cloud computing environment 650 comprises one or more cloud computing nodes 510 with which local computing devices used by cloud consumers, such as, for example, personal digital assistant (PDA) or cellular telephone 654A, desktop computer 654B, laptop computer 654C, and/or automobile computer system 654N may communicate. Nodes 510 may communicate with one another. They may be grouped (not shown) physically or virtually, in one or more networks, such as Private, Community, Public, or Hybrid clouds as described hereinabove, or a combination thereof. This allows cloud computing environment 650 to offer infrastructure, platforms and/or software as services for which a cloud consumer does not need to maintain resources on a local computing device. It is understood that the types of computing devices 654A-N shown in FIG. 6 are intended to be illustrative only and that computing nodes 510 and cloud computing environment 650 can communicate with any type of computerized device over any type of network and/or network addressable connection (e.g., using a web browser).
Referring now to FIG. 7, a set of functional abstraction layers provided by cloud computing environment 650 (FIG. 6) is shown. It should be understood in advance that the components, layers, and functions shown in FIG. 7 are intended to be illustrative only and that embodiments of the invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:
Hardware and software layer 760 includes hardware and software components. Examples of hardware components include mainframes, in one example IBM® zSeries® systems; RISC (Reduced Instruction Set Computer) architecture based servers, in one example IBM pSeries® systems; IBM xSeries® systems; IBM BladeCenter® systems; storage devices; networks and networking components. Examples of software components include network application server software, in one example IBM WebSphere® application server software; and database software, in one example IBM DB2® database software. (IBM, zSeries, pSeries, xSeries, BladeCenter, WebSphere, and DB2 are trademarks of International Business Machines Corporation registered in many jurisdictions worldwide).
Virtualization layer 762 provides an abstraction layer from which the following examples of virtual entities may be provided: virtual servers; virtual storage; virtual networks, including virtual private networks; virtual applications and operating systems; and virtual clients.
In one example, management layer 764 may provide the functions described below. Resource provisioning provides dynamic procurement of computing resources and other resources that are utilized to perform tasks within the cloud computing environment. Metering and Pricing provide cost tracking as resources are utilized within the cloud computing environment, and billing or invoicing for consumption of these resources. In one example, these resources may comprise application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. User portal provides access to the cloud computing environment for consumers and system administrators. Service level management provides cloud computing resource allocation and management such that required service levels are met. Service Level Agreement (SLA) planning and fulfillment provide pre-arrangement for, and procurement of, cloud computing resources for which a future requirement is anticipated in accordance with an SLA.
Workloads layer 766 provides examples of functionality for which the cloud computing environment may be utilized. Examples of workloads and functions which may be provided from this layer include: mapping and navigation; software development and lifecycle management; virtual classroom education delivery; data analytics processing; transaction processing; and collaboration and gathering detection.
Thus, in certain embodiments, software or a program, implementing collaboration and gathering detection in accordance with embodiments described herein, is provided as a service in a cloud environment.
In certain embodiments, the computing nodes 100 a . . . 100 n each have the architecture of computing node 510. In certain embodiments, the computing nodes 100 a . . . 100 n are part of a cloud environment. In certain alternative embodiments, the computing nodes 100 a . . . 100 n are not part of a cloud environment.

Additional Embodiment Details

The present invention may be a system, a method, and/or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention.
The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD) or Blu-Ray disc, a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.
Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.
Computer readable program instructions for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present invention.
Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.
These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks.
The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks.
The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.

Claims

What is claimed is:

1. A method for determining relationships between entities, comprising:

determining whether a first entity is associated with a second entity on at least a certain number of occasions over a certain first time interval;

in response to a positive determination, finding a first instance of affinity between the first entity and the second entity;

identifying a collaboration based on the first instance of affinity and one or more second instances of affinity found within one or more certain portions of a second time interval; and

reporting the collaboration of the first entity and the second entity.

2. The method of claim 1, further comprising:

determining that the first entity and the second entity have physical affinity when the first entity is situated within a certain spatial proximity of the second entity on the number of occasions over the first time interval.

3. The method of claim 1, further comprising:

determining that the first entity and the second entity have virtual affinity when the first entity communicates with the second entity on the number of occasions over the first time interval.

4. The method of claim 3, further comprising:

identifying a mode via which the first entity communicates with the second entity.

5. The method of claim 1, further comprising:

determining instances of affinity among entities of various types based on various numbers of occasions and various first and second time intervals.

6. The method of claim 1, further comprising:

updating the number of occasions and the first and second time intervals based on a criterion.

7. The method of claim 1, further comprising:

identifying a gathering based on the first instance of affinity and the one or more second instances of affinity and based on a number of entities that qualifies as a gathering.

8. The method of claim 1, wherein software is provided as a service in a cloud environment.

9. A computer program product, the computer program product comprising a computer readable storage medium having program code embodied therewith, the program code executable by at least one processor to perform:

reporting the collaboration of the first entity and the second entity.

10. The computer program product of claim 9, further comprising:

11. The computer program product of claim 9, wherein the program code is executable by the at least one processor to perform:

12. The computer program product of claim 11, wherein the program code is executable by the at least one processor to perform:

13. The computer program product of claim 9, wherein the program code is executable by the at least one processor to perform:

14. The computer program product of claim 9, wherein a Software as a Service (SaaS) is configured to perform the computer program product operations.

15. A computer system, comprising:

one or more processors, one or more computer-readable memories and one or more computer-readable, tangible storage devices; and

program instructions, stored on at least one of the one or more computer-readable, tangible storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to perform:

reporting the collaboration of the first entity and the second entity.

16. The computer system of claim 17, wherein the operations further comprise:

17. The computer system of claim 17, wherein the operations further comprise:

18. The computer system of claim 17, wherein the operations further comprise:

19. The computer system of claim 17, wherein the operations further comprise:

20. The computer system of claim 15, wherein a Software as a Service (SaaS) is configured to perform the system operations.